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DETAILEDACTION 

Specification 

The title of the invention is not descriptive. A new title is required that is clearly 
indicative of the invention to which the claims are directed. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claim 18 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

The specification does not provide an adequate disclosure showing what is 
meant by the "processing mean (127) for outputting". Because of this, the claim fails to 
particularly point out and distinctly claim the invention since one of ordinary skill would 
not understand what structure corresponds to the claimed function. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



4' 
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The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 1 03(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

Claims 1,3, 4, 6, 8, 9, 11, 12, 14, 16, 18, 20, 21, 23, 24, and 25 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Mauro (US 2002/0147920) in view of Craft et 
al. (US 2002/0150243) 



Claim 1 
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Mauro discloses a method for managing cryptographic keys that are specific to a 
personal device(100), the method being performed at a secure processing point(150) 
arranged in communication with the personal device, characterised in that the secure 
processing point performs the steps of: retrieving a unique chip identifier from a read- 
only storage(120) of an integrated circuit chip (110) included in the device (100) ( 
paragraph [0038]) ; A read only memory (ROM 252) stores secure parameters ( e.g., a 
unique chip identifier) via a secure operation (e.g., during the manufacturing phase) and 
become available for use thereafter (e.g. retrieving a unique chip identifier). 

storing a data package in the device, the data package including at least one 
cryptographic key(paragraph [0034], lines 1-7); A secure unit 240 to perform all secure 
processing and store all "sensitive" data ( e.g. cryptographic key) by various 
cryptographic technique. 

Mauro does not disclose other features in claim 1 such as receiving in response 
to storing the data package, associating the unique chip identifier with the received 
backup data package , and storing the backup data package and the associated unique 
chip identifier. 

Craft et al. disclose other features such as receiving, in response to storing the 
data package, a backup data package from the device(100), which backup data 
package is the data package encrypted with a unique secret chip key stored in a 
tamper-resistant secret storage(125) of the chip (100) (paragraph [0021] and paragraph 
[0019]). A server system receives encrypted content data using permanent, hardware- 
embedded, cryptographic keys (tamper-resistant secret storage) from a client. 
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associating the unique chip identifier with the received backup data package; 
(paragraph [0041] lines 7-13) 

storing the backup data package and the associated unique chip identifier in a 
permanent public database (170) (paragraph [0043], lines 1-6 and figure 2). A client 
serial number (216) is equivalent to a unique chip identifier and a client public key 
datastore (222) is equivalent to a permanent public database. Thus, it would have been 
obvious to the person of ordinary skill in the art at the time of the invention was made to 
modify the method of Mauro by including other feature such as receiving in response to 
storing the data package, associating the unique chip identifier with the received backup 
data package , and storing the backup data package and the associated unique chip 
identifier of Craft because it would ensure security of the communication between client 
devices and servers (paragraph [0013], lines 1-4, Craft et al.). 

Claim 3 

Craft et al. also disclose wherein the at least one cryptographic key includes at 
least one key to be used for a secure, key based communication channel between a 
personal device manufacturer and the personal device (paragraph [0038], figure 2). 

Claim 4 

Craft et al. also disclose wherein the at least one key to be used for a secure, key 
based communication channel includes a symmetric key (paragraph [0038], lines 1-5; 
paragraph [0060], lines 20-24). The symmetric key is a cryptographic key which uses 
trivially cryptographic key for both decryption and encryption. 
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Claim 6 

Craft et al. discloses wherein the at least one key to be used for a secure, key 
based communication channel includes a private/public key pair (paragraph [0038], 
paragraph [0032], lines 1-3). 

Claim 8 

Claim 8 is rejected as in above discussion (claim 1 and claim 2). Craft et al. also 
disclose wherein the personal device is a wireless communications terminal and the 
unique device identity is an identifier which identifies the wireless communications 
terminal in a wireless communications network ( paragraph [0025], lines 13-16). 
Personal digital assistant (PDAs, client 107) is equivalent to a wireless personal device. 

Claim 9 

Mauro discloses a system for managing cryptographic keys that are specific to a 
personal device, the system including at least one personal device (100) and a secure 
processing point (150), which secure processing point is arranged in communication 
with the personal device, characterised in that: 

the device includes an integrated circuit chip (110) with a unique chip identifier in 
a read-only storage (120) and a unique secret chip key in a tamper-resistant secret 
storage (125). (paragraph [0038]; paragraph [0039], lines 9-11); 
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the secure processing point includes processing means(155) for retrieving the 
unique chip identifier and for storing a data package in the device, the data package 
including at least one cryptographic key (paragraph [0038]; paragraph [0034], lines 1- 
7); 

the device includes processing means(127) for encrypting the received data 
package with the unique secret chip key and transferring a resulting backup data 
package back to the secure processing point (paragraph [0036], lines 8-11); 

Mauro does not disclose the processing means of the secure processing point is 
arranged for storing the received backup data package. 

Craft et al. disclose the processing means of the secure processing point is 
arranged for storing the received backup data package in association with the unique 
chip identifier in a permanent public database(170). (paragraph [0043], lines 1-6 and 
figure 2). A client serial number (216) is equivalent to a unique chip identifier and a 
client public key datastore (222) is equivalent to a permanent public database. 
Thus, it would have been obvious to the person of ordinary skill in the art at the time of 
the invention was made to modify the system of Mauro by including the processing 
means of the secure processing point is arranged for storing the received backup data 
package of Craft because it would ensure security of the communication between client 
devices and servers (paragraph [0013], lines 1-4, Craft et al.). 



Claim 11 
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Craft et al. also disclose the system as~claimed in claim 9, wherein the at least 
one cryptographic key includes at least one key to be used for a secure, key based 
communication channel between a personal device manufacturer and the personal 
device, (paragraph [0038], figure 2). 

Claim 12 

Craft et al. also disclose the system as claimed in claim 1 1 , wherein the at least 
one key to be used for a secure, key based communication channel includes a 
symmetric key. (paragraph [0038], lines 1-5; paragraph [0060], lines 20-24). The 
symmetric key is a cryptographic key which uses trivially cryptographic key for both 
decryption and encryption. 

Claim 14 

Craft et al. also disclose the system as claimed in claim 11, wherein the at least 
one key to be used for a secure, key based communication channel includes a 
private/public key pair (paragraph [0038], paragraph [0032], lines 1-3). 

Claim 16 

Craft et al. also disclose the system wherein the personal device is a wireless 
communications terminal and the unique device identity an identifier which identifies the 
wireless communications terminal in a wireless communications network. 
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(paragraph [0025], lines 13-16). Personal digital"assistant (PDAs, client 107) is 

equivalent to a wireless personal device. 

Claim 18 

Mauro discloses a personal device (100) managing cryptographic keys that are 
specific to the personal device, characterised in that the personal device includes: 

an integrated circuit chip(1 10) with a unique chip identifier in a read-only 
storage(120) (paragraph [0038] , lines 1-4) . A read only memory (ROM 252) stores 
secure parameters (e.g., a unique chip identifier). 

memory means(130) for storing a received data package including at least one 
cryptographic key (paragraph [0037], lines 1-3). A flash memory is a form of non- 
volatile memory which is equivalent to memory (130) (paragraph [0034], lines 1-7). A 
secure unit 240 to perform all secure processing and store all "sensitive" data (e.g. 
cryptographic key) by various cryptographic technique. 

Mauro does not disclose a unique secret chip key in a tamper-resistant secret 
storage(125). 

Craft et al. disclose a unique secret chip key in a tamper-resistant secret 
storage(125) (paragraph [0021] and paragraph [0019]). A server system receives 
encrypted content data using permanent, hardware-embedded, cryptographic keys 
(tamper-resistant secret storage) from a client. 

processing means(127) for outputting the unique chip identifier (claim 12). 
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processing means( 127) for encrypting the receiveddata package with the unique 
secret chip key and outputting a resulting backup data package to a permanent public 
database(170). (abstract and page 4, paragraph [0043], lines 1-6 and figure 2, abstract). 
Encrypting a request which includes a client serial number (216) is equivalent to encrypt 
the received data package with the unique secret chip key. The client serial number 
(216) is equivalent to a unique chip identifier and a client public key datastore (222) is 
equivalent to a permanent public database. 

Thus, it would have been obvious to the person of ordinary skill in the art at the 
time of the invention was made to modify the device of Mauro by including a unique 
secret chip key in a tamper-resistant secret storage(125) of Craft because it would 
ensure security of the communication between client devices and servers (paragraph 
[0013], lines 1-4, Craft etal.). 

Claim 20 

Craft et al. also disclose the personal device as claimed in claim 18, wherein the 
at least one cryptographic key includes at least one key to be used for a secure, key 
based communication channel between a personal device manufacturer and the 
personal device, (paragraph [0038], figure 2). 



Claim 21 
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Craft et al. also~disclose~the personal device as claimed in claim 20rwherein the at least ~ 
one key to be used for a secure, key based communication channel includes a 
symmetric key. (paragraph [0038], lines 1-5; paragraph [0060], lines 20-24) . The 
symmetric key is a cryptographic key which uses trivially cryptographic key for both 
decryption and encryption. 

Claim 23 

Craft et al. also disclose the personal device as claimed in claim 20, wherein the 
at least one key to be used for a secure, key based communication channel includes a 
private/public key pair (paragraph [0038]; paragraph [0032], lines 1-3). 

Claim 24 

Craft et al. also disclose the personal device as claimed in claim 18, wherein the 
personal device is a wireless communications terminal and the unique device identity is 
an identifier which identifies the wireless communications terminal in a wireless 
communications network, (paragraph [0025], lines 13-16). Personal digital assistant 
(PDAs, client 107) is equivalent to a wireless personal device. 

Claim 25 

Mauro discloses a secure processing point(150) for managing cryptographic keys 
that are specific to personal devices, the secure processing point being capable of 



Application/Control Number: 10/696,495 Page 12 

Art Unit: 21 12 

" communicating with a personal"device(100), characterised in that the secure"processing " 
point includes processing means(155) for: 

retrieving a unique chip identifier from a read-only storage(120) of an integrated 
circuit chip(1 10) included by the personal device(100) (paragraph [0038]) . A read only 
memory (ROM 252) stores secure parameters ( e.g., a unique chip identifier) via a 
secure operation (e.g., during the manufacturing phase) and become available for use 
thereafter (e.g. retrieving a unique chip identifier). 

storing a data package including at least one cryptographic key in the personal 
device (page 2, paragraph [0034], lines 1-7); A secure unit 240 to perform all secure 
processing and store all "sensitive" data (e.g. cryptographic key) by various 
cryptographic technique. Mauro does not disclose other features such as receiving and 
storing. 

Craft et al. disclose the following features: 

receiving an encrypted version of the data package, in the form of a backup data 
package, from the personal device in response to the stored data package (paragraph 
[0021] and paragraph [0019]). A server system receives encrypted content data using 
permanent, hardware-embedded, cryptographic keys (tamper-resistant secret storage) 
from a client. 

storing the received backup data package in association with the unique chip 
identifier in a permanent public database(170) (paragraph [0043], lines 1-6 and figure 
2). A client serial number (216) is equivalent to a unique chip identifier and a client 
public key datastore (222) is equivalent to a permanent public database. Thus, it would 
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have been obvious to the person~ofordinary skill inthe art at the time of the invention 
was made to modify the method of Mauro by including other features such as receiving 
an encrypted version of the data package and storing the received backup data 
package in a permanent public database of Craft because it would ensure security of 
the communication between client devices and servers (paragraph [0013], lines 1-4, 
Craft et al.). 



Claims 2, 5, 10, 13, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
Mauro and Craft et al. as applied to claims 1 , 9, and 18 above and further in view of 
Messerges et al. (US 2002/0157002) 

Claim 2 

Mauro and Craft do not disclose a unique device identity. Messerges et al. 
disclose wherein the secure processing point performs the further steps of: 

associating a unique device identity ( paragraph [0030], lines 3-7). Messerges et 
al. do not disclose a unique chip identifier. Craft et al. disclose the unique chip identifier 
(paragraph [0041], lines 7-10). Thus, it would have been obvious to the person of 
ordinary skill in the art at the time of the invention was made to combine the teachings 
of Mauro and Craft as motivated by Messerges because it establishes a unique 
identifier of a communication device (claim 28, Messerges). 

Craft et al. disclose other features such as signing the result of said associating 
step with a manufacturer private signature key corresponding to a manufacturer public 
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"signature key stored in a read-only memory~of the~device, thereby generating a 

certificate for the unique device identity (paragraph [0036]); 

storing the certificate in the device (paragraph [0036] ); and 

storing the unique device identity and the certificate in association with the 

backup data package and the unique chip identifier in the permanent public database 

(paragraph [0043], lines 1-6). 

Claim 5 

Mauro and Craft do not disclose a symmetric key is generated. 

Messerges et al. disclose the other method as claimed in claim 4, wherein the 
symmetric key is generated as a function of a master key and the unique device identity 
(paragraph [0041], lines 36-39; paragraph [0030], lines 3-7; paragraph [0068], lines 8- 
10). A device manufacturer may be securely embedded keys into a user device so that 
each user device can be uniquely identified to the other. A unique, factory installed, unit 
public-key of a user device is equivalent to master key and unique device identity. Thus, 
it would have been obvious to the person of ordinary skill in the art at the time of the 
invention was made to modify the teachings of Mauro and Craft by including the 
symmetric key is generated as a function of a master key and the unique device identity 
as suggested by Messerges because it establishes a unique identifier of a 
communication device (claim 28, Messerges). 



Claim 10 
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Mauro and Craft do not disclose a unique deviceldentity: Messerges et al. 
disclose wherein the processing means(155) of the secure processing point(150) further 
is arranged for: 

associating a unique device identity (paragraph [0030], lines 3-7). Craft et al. 
disclose the unique chip identifier (paragraph [0041], lines 7-10). Thus, it would have 
been obvious to the person of ordinary skill in the art at the time of the invention was 
made to combine the teachings of Mauro and Craft as motivated by Messerges 
because it establishes a unique identifier of a communication device (claim 28, 
Messerges). 

Craft et al. disclose other features such as signing the result of the association 
with a manufacturer private signature key corresponding to a manufacturer public 
signature key stored in a read-only memory of the device, thereby generating a 
certificate for the unique device identity (paragraph [0036]); 

storing the certificate in the device (paragraph [0036]); and 
storing the unique device identity and the certificate in association with the 
backup data package and the unique chip identifier in the permanent public database, 
(paragraph [0043], lines 1-6). 

Claim 13 

Messerges et al. also disclose the system as claimed in claim 12, wherein the 
symmetric key is generated as a function of a master key and the unique device 
identity, (paragraph [0041], lines 36-39 paragraph [0030], lines 3-7; paragraph [0068], 
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lines~8-T0):~A~device manufacturer may be securely embedded'keyslnto a user device 
so that each user device can be uniquely identified to the other. A unique, factory 
installed, unit public-key of a user device is equivalent to master key and unique device 
identity. 

Claim 22 

Messerges et al. also disclose the personal device as claimed in claim 21 , 
wherein the symmetric key is generated as a function of a master key and the unique 
device identity (paragraph [0068], lines 8-10). A unique, factory installed, unit public-key 
of a user device is equivalent to master key and unique device identity. 

Claims 7, 15, and 26 are rejected under 35 U.S.C. 103(a) as being unpatentable Mauro 
and Craft et al. as applied to claims 1 , 9, and 25 above and further in view of Ginter et 
al. (US patent 5,892,900) 

Claim 7 

In addition to the discussion above, Craft et al. also disclose wherein the 
private/public key pair either is: 

generated by the secure processing point during assembly of the device ( 
paragraph [0042], lines 1-6). Each client CPU chip has a cryptographic unit 
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(public/private key) that has' been m programmablenrremory — 

storage. 

Mauro and Craft et al. do not disclose how to generate and store in advance in a 
secure database. Ginter discloses how to generate and store in advance in a secure 
database before assembly of the device, in which latter case the cryptographic keys 
stored in advance of assembly are removed from the secret database after reception of 
the backup data package. (Column 169, lines 9-17; claim 101). An electronic appliance 
600 updates its secure database 610 and/or SPU 500. If an information received, an 
end user's electronic appliance 600 requesting the electronic appliance to delete the 
information that has been transferred. The information comprises at least one or more 
cryptographic keys. Thus, it would have been obvious to the person of ordinary skill in 
the art at the time of the invention was made to modify the teaching of Mauro and Craft 
by including how to store the cryptographic keys in advance and removed from the 
secret database as suggested by Ginter to improve system security (column 215, lines 
33-35, Ginter). 

Claim 15 

In addition to the discussion above, Craft et al. also disclose the system wherein 
the processing means of the secure processing point either is: 

arranged for generating the private/public key pair during assembly of the device 
(paragraph [0042], lines 1-6) . Each client CPU chip has a cryptographic unit 
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(public/private key) that has"been~manufactured to~contain programmable~memory 
storage. 

Mauro and Craft et al. do not disclose arranging for retrieving the private/public 
key pair from a secure database. 

Ginter et al. disclose arranged for retrieving the private/public key pair from a 
secure database (140), in which the key pair has been stored in advance before 
assembly of the device, in which latter case the secure processing point further is 
arranged for removing the key pair from the secret database after reception of the 
backup data package (Column 169, lines 9-17; claim 101). An electronic appliance 600 
updates its secure database 610 and/or SPU 500. If an information received, an end 
user's electronic appliance 600 requesting the electronic appliance to delete the 
information that has been transferred. The information comprises at least one or more 
cryptographic keys. Thus, it would have been obvious to the person of ordinary skill in 
the art at the time of the invention was made to modify the teaching of Mauro and Craft 
by including an arrangement for retrieving the private/public key pair from a secure 
database as suggested by Ginter to improve system security (column 215, lines 33-35, 
Ginter). 

Claim 26 

Craft et al. disclose the secure processing point as claimed in claim 25, wherein 
the processing means(155) further is arranged for: 
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signing the result of the~association~with a manufacturer private signature key 
corresponding to a manufacturer public signature key stored in a read-only 
memory of the device, thereby generating a certificate for the unique device identity 
(paragraph [0036]); 

storing the certificate in the device (paragraph [0036]); 

storing the unique device identity and the certificate in association with the 
backup data package and the unique chip identifier in the permanent public database 
(paragraph [0043], lines 1-6); 

the unique chip identifier (paragraph [0041], lines 7-10). 
Mauro and Craft et al. do not disclose a unique device identity. 

Messerges et al. disclose a unique device identity (paragraph [0030], lines 3-7). 
Thus, it would have been obvious to the person of ordinary skill in the art at the time of 
the invention was made to modify the teaching of Mauro and Craft by including the 
unique device identity as suggested by Messerges because it identifies the unique 
identifier of a communication device (claim 28, Messerges). 

Claims 17 is rejected under 35 U.S.C. 103(a) as being unpatentable over Mauro and 
Craft et al. as applied to claim 1 above and further in view of Aota et al. (US patent 
5,564,032). 



Claim 17 
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Mauro discloses method of recovering a"backup~data~package of a personal 
device (100), which backup data package has been assembled and stored in 
accordance with claim 1 , the method including the steps of: 

reading a unique chip identifier from a read-only storage (120) of the personal 
device (100) ( paragraph [0038]). A read only memory (ROM 252) stores secure 
parameters ( e.g., a unique chip identifier) via a secure operation (e.g., during the 
manufacturing phase) and become available for use thereafter (e.g. retrieving a unique 
chip identifier). Mauro does not disclose other features such as transmitting, receiving, 
and storing. 

Craft et al. disclose the following features: 

transmitting the chip identifier to a public database (170) ( paragraph [0043], lines 
1-6 and figure 2). 

receiving from the public database the backup data package corresponding to 
the transmitted chip identifier (lines 8-15, paragraph [0015]); and 

storing the received backup data package in the personal device ( paragraph 
[0015], lines 15-19). Thus, it would have been obvious to the person of ordinary skill in 
the art at the time of the invention was made to combine Mauro and Craft as motivated 
by Aota in order to recover an information in nonvolatile memory (flash memory) 
(abstract; claim 1 , Aota et al.) 
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~ClaiiTf19is rejected" under 35 U.S.C. 103(a) as~being unpatentable Mauro and Craft et 
al. as applied to claim 18 above and further in view of Ober et al. (US patent 6,654,465) 

Claim 19 

In addition to the discussion of Mauro and Craft above, Craft et al. also disclose a 
client public key is stored in a read-only memory structure in an article of manufacture in 
the client (claim 27), and memory can be one or more type of volatile and non-volatile 
memory ( paragraph [0029], lines 3-6). A client public key corresponding to client private 
key are stored them within a server's client public key datastore 222. (paragraph 43, 
lines 3-6). Mauro and Craft et al do not disclose how to add its digital signature. 

Ober et at. disclose how to sign digital signature by chip manufacturer ( column 
4, lines 8-15; and lines 36-38). Thus, it would have been obvious to the person of 
ordinary skill in the art at the time of the invention was made to combine the teachings 
of Mauro and Craft as motivated by Ober to generate a recovery key encryption key in 
secure manner (abstract , Ober et al.). 

Conclusion 

The prior arts made of record and not relied upon are considered pertinent to 
applicant's disclosure. The prior arts disclose information about memory, processor, 
I/O, cryptographic keys, clients, servers, database, wireless, and devices. 
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Any inquiryconcerning this communication or earlieT'communications from the 
examiner should be directed to Canh Le whose telephone number is 571-270-1380. 
The examiner can normally be reached on Monday to Friday 7:30AM to 5:00PM other 
Friday off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Walter Griffin can be reached on 571-272-1447. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Canh Le 

September 20, 2006 
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